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(57)Abstract: 

PROBLEM TO BE SOLVED: To enable the security monitor 
device, which monitors access on equipment having an external 
access means, to maintain and manage the security closely even if 
user authentication information leaks. 

SOLUTION: An access monitor means 10 stores an access log as 
security management information when access is gained, detects 
the difference from the obtained security management information 
from the current access and the past access log to decide whether 
or not the access is different from normal access, and generates an 
alarm by an abnormality alarm means 20 if the access is different 
from the normal access. Further, an alarm processing means 30 
once informed of the alarm from the abnormality alarm means 20 
performs a specific alarm process set by an alarm process setting 
means 31. 
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1H0H1MR2 0 5 tt, *f»a— tf-^WME©*** !Jf^l/ 
*ir*$iJP51il$&2 0 5*i®ffi$tu53-— iflco^tli, 

rjitit), H8t*tf!)[a-' Vmort-tx 

©JPSIf « 2 0 5 fcftfe'B , B 7 }C^-f i 5 ftita-f 

io fc*fi-5T^-t^ftijPH#«2 o^&mmztiz,, 
[0053] mm*-— mcMi- * y w<a< 

[0 0 5 4] SfSffi^CT^t^iLTIl, ^ 

20 ««*»fe©i|ie»W7'^-fe^l>**)#5. «itf. ^~ 

jfcv > 3 ^ k°zl — ^ |^±cor ^ -tr ^ (cov >t t * * a- y 7=- 

[0 0 5 5] B9»i, /U-y— M7-^Srg 
* 1" 5 T ^ -fe ^ "b# ?j tt5 T ^ -fe ^. n i7*c»^J Sr^-f- c 
■fedfa y^^^SSBl 1 2{i, |g9^-f-T^-fe^D^ 
30 2 0 6 Sr, 13 1 0 p y x -f 1?SHf$l 2 

0 7tag»LTC1tLT*i<. 

[0 0 5 6] r <D«^co n i/iklSfelli, ^^L«i^<D<J; 
0\C'<7t>tlZ> o n ^Jfci&gB l l 5 «, H9cD7*-tr*n 
^2 0 6tHl 0Ct^fa!if^fIlti2 0 7t*Jt 

x-fl : sit«2 o 7fcE»s*tT^5«#©aHi#a»e> 
a!)r^ ffait « 207 icis^^^T v**ir*i3&flMf a»e> 
40 *nL, AffV^^i 2 0ii, J: 5 

[0057] : tf*»e>^«— ^ase>n 

<Dfaft,x.—V{cttl,X&-tZZtlc£*), <§m%*tzit 

J i\>* \z.Wk lx bffit>fo -> 3 y fa-^-cgStf 4 5 l 
[oo 5 8] hi lie ^i <DmM<DBmc£.z>mm<D 

50 ^0«tS*^-to T^-fe^n^St^gBl 1 lK«fct>7 
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o i £Bi#u -fe^a y^^wait»2 o 

SfcaafcLT-fc^ay^-ffcaSU 1 2 (CfE®-T§ (* 
fy/Sl) . 2fctc^, n^Jfc«»l 1 5fcJ:t>, T^-fe 
^o^201 0 7^*8111*2 0 3 ifcitigEL 

(*rs/7°S2) , 0 l<£>F*3^-ir3r a 

y <f fSIf n 2 0 3 ©«5fflF*1-Cfc5*>if 5 /W-4 0 . 

2 0KioT*tttSr*t5. il^7*-fe* 
T*fc5*-a-(C«, Sfefc, fMRBifctSgBl 1 61C497* 
nn^201 i:T^-fe^$iJ|5gtf«2 0 4 iSrifctSEb 

T^-l?*n^2 0 1 &T*tXfflmgn2 0 4 lcS-3< 
7*-fc*ttl8©ttfflrt-?S>ft»i, *fft«12 0tJ: 
9 L (^f?/S6) , 7^«B^20 
l*S7***MI5»tt||*Tabfttf, n&©i^£ss-t- 
5ii:^<, #c©T^-fc;*.£#o 0 
[0 0 5 91111211. *3BWSra[ffl-f5t>oi:t>ft« 

tSggl 0 0 i&3fc&3. a^fa.-* 3 0 OfcrfcV 
T, *y M7— ^ 3 0 4/l^(DT^-tr^-^=i^t' , 3.— * 
3 0 0##^©=¥-tf?— K^v^^/j:if©A^gt3 0 

ia»f> ©7 ft, tf^ttx-f^^W 3 o 

2t^$ft5o T^t^cm^ !)f-f Waif* 
, SyN _ K9 f A ^ $ ^coWmm. 3 0 3KEWil, itlfc 

SH3 0 3 ClfE&£tl<$. 
[0 06 0] Cm 2 ©HJfi©^fS) 
*V^T^.-fe^i:!pJWrUfc»frlcH:#l!r**i-S*s. ^© 

7***fcflFi*l,;fe:«5#J:VV*fc. S< 

K tit, 8 2 ©2B6©JEH»-T?tt, r©J:5**fr© 

[0 0 6 1] H 1 3 14. #Sg§3©il 2 ©H16©»*|Co 
^T©#f/&#l£^-f:7*n 5/^0T'&-5„ 0 1 3 tc^-fr-fc 
*~ y r-fi£ta^B4 0 014, l2l:^f-lr^ i !Jf^ 

gm^e looi m&v^mzmz., £ e> Ki*«*a9tt 

SS54 1 0&¥#aaA4 2 0i^M5„ 

^a^tsiu i o t&&f&gM4 2 oew©0 1 3 ic* 
+4r¥m% 0 2 t^-t-p c&mwztix^z^mz 

fgffig|$12 2f4, W^Sfil 4 OlclE^Srffi^i-rsftfc 
[0 0 6 2] #^*&aR*a5 4.1 0f±. *#«r»Lfc« 
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0f4, JWMP^fBJl 2-0d»feO##©fflftlSrS(tT## 

ffiaRftHu i 0T»«*nfcflMRKtto-r#ft«3asr 

[0 0 6 3] ¥&timWt%M4 1 01^4 9. ^»R«S 

titt&tskwmi£<Dm&, miAizmt. 015 

(4, #«WaR£fc:*r&LfcaL~ 

«. Bi6i4, #»**a3iRSfc#«i:ufc«a#K«i- 

10 [0 0 6 4] Hi 4 K^-f ( 1 ) ©##«HiKftasfTto 
3.— y-*(DT^-fexti«ih$ti. a.— fjiD^T? 

h£ft5„ rott, a-fira-LT, HI 5 (1) © 
rr<DT^-fe^{4*Jh$ftTV*fo ifc&fc©^-— !f I 
DHtoy * Sft* Lfco WST^-fe^1-5^»4« : a#IC 

£fc, tfa#te#LTH:, 016 (1) © r£jfc$*i,fc 
T^ir^^fct)* tfco a.— if x x x x x(4n y?TV 
h£ft£Lfc 0 j £l^5*y-tr-S?astttfj3ft.5,, 
20 [0 0 6 5] Sfc, 014 tw^-f (2) OfSi&iKll 
#?Tfc>ftfc#fr, 4 2 0 K 4 o -C»*!JS** 

bftfc^, »— !f©T*-te*Ht*Jh;Sft.5. r©it, 
a--if(c:*rLTJ4, 015 (2) ©> s/-fe-^a*Hj7j£ 
ft. *S#fc#LTtt. 016 (2) 9>*r*—*J#m 

7j£ft5„ 

[0 0 6 6] 014 iCifrt ( 3 ) OfSHR^fffc 

ftfc«*. »#&aiB54 2 oti-3-c#^3js«*e)ftfc 

ft5 0 at— !f«-€rft*-C#«-r5. i©i#, a— 
30 MUTte, 015 (3) ©p«yfe-^m**ft, ffa 
#!C*fLT{4, 016 (3) ©*5rfe-5?#tti;aSft 

[0 0 6 7] Hl4K*t (4) 
ftfc»*. #£&a§&4 2 0I^J:oT»«^**6ftfc 
^, a-— y-'(i^2©/-?^.7- K*S*«>6)ft, ^ft/SSoES 
t^Jt>P>ft5*g-(c:PS'9, T^-fc^SfFpI^tv-So -co 
it. at— !flC»LT(4, 015 (4) <D* 
W*4ft, fiflCtLttt, 016 (4) ©^y-fe- 

40 [00681014 \Z7jk-t ( 5 ) W&fEm&fetfftfr 
ftfc#^, #1Waa«B54 2 0|cJ:oT#i!r*S3S*6>ft5 
^. T^-fe^i4tfnI$ft'5„ a— TlCStLT 
14, 015 (5) <Z»yfc-S?j&*ttWj*ft, f=a#{r*f 
LTi4, 016 (5) yfe-^asm^$ft5. 

[0069] 0i 4\c^-t (6) oii^aaKJtasfi 1 *? 

ftfc*^-, »§*Q.ag|I4 2 0fc±5£#f4fTfc>ft-f, ii 
»ii t) T^ir^aSjggfT^ftS. rftl4 "ir^a Uf-f/i 

50 [00 7 0] ftfc, £t±©*##fflaKJek:Jt 
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wi>mzi£^x.)K.-r&z.£ twigx-foSo bi 7 k, 

■fe-*n^#g|$i i i d^T^-fe^ci^ 0 1 
L, t* a !)r-ffHtS2 0 3l:^Lttdrayf 
-f*S»l 1.2KE«r*-S Uf5-7'S2 1) . 
Di/itgjgiSl 1 5(Ci 13, 7n7n^201it^ 
!» f 1 W ^atifS 2 0 3 £ fcifctfc L (XT y 7°S 2 2 ) , 
7^t^n^20 l©^St^f3yf^fltti2 0 
3<o&fflftX'hZ>fr¥oMc£*), »fitr 5- 10 

(^fyys2 3) „ ilffrT^-tr^-Cftv 
•S-fctt, ^fyT'S 2 6^x1*. ^S#£SP12 0£ 
^LT*^AQ.agB4 2 OK£Z&g$m&ft ! ?o m%T 
f-tXThZWr&M-t, SfctCl, l&JpgJfctfcSBl 1 6K«fc 
►)T^-ir^n^201 t T^-tr^fMRgfifgl 2 0 4 iSrtfc 
tXL (^ryyS2 4) , 7^tXP^2 0 1i!7^t 

2 5) o 7?±7.u?2 0 l*ST^-fe^*lJI5fi?fR2 0 4 

6^ittf„ T^-fe^n^2.0 l1)}7<?-txVm<Oimir[- 20 

•c*>^tf, «^s^=fT5it^<, &©r 

[0 0 7 1] Xfy7'S2 6-eii, f §MlSSai4 1 

otipjjfiwfcRjesttfcfffifjtaiKscfto-c, mi 

5*5iT/01 6|o^-tJ;5^^s/-fe-v ? 2rtii^L > 01 

[0072] imaoMfooMm IU*3J:tff?2©Ji 
Jico^ffiT-H, 3^b*3.— ^--©T^ir^roWcov^ 

[0073] ii8it *mw<om3<D$zm<DMmKr> 

tSSS5 0 0l±, **5e«»5 10, j|ffff«5 2 
[0 0 7 4] 7^5 3 Oli, StlieUfc^JfeW^ 

520 2 0 \z, m^ms 540 

Iittl^l4 0i:, *n^n«s-j-5. 
[0 0 7 5] mi 9«. mi 8{c^-f$iBS:es«Ag 40 

lt(4, mxnm^m, as, 

itSSrSt#UT*3#, iI#tl±Mft5l#IW*iH>A#5lel& 
[0 0 7 6] Afcttfctt, SEA©»*«FIW, A*, "C# 

»-W^A^Si55 l iicJ:oTtt»U uS^-^FDir 

W31SP5 1 2(ClBtt-r5o $ bl-, B& • WfclW»5 
15lCit), Bfe • f^D^fia!5 1 2fcSJ*Lfcr. 
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X'hZ>bWBrL1zm&Mt, A**«tt 5 2 o lei t) , 
-**fflV^T»ft-J-«. «HRJfctMB5 1 6fcJ: 

5 r. t fc-CtS. ft*5, Wfc«rA*i-a«l& 
RWUfc*. ■7-<^n^^e>A^Lfc : S : j*if#*-fe:df 

[0077] E20»i, 018 KwtM^^SMWS^ 

[0 0 7 8] *frfi«)lwtt, ' fc5Jft£©iijfi*©ti*$R, "J" 
5 1 1IC±9»»U Mfc****^* 

asp 5 1 2tciatii-5o Bft-«^jtfi»5i 

•C*>Si:.WWrbfc»4^tt. JWr*«r»5 2 (HCfcU. 

-»*fflV^T##i-6. J|iiJpgittSSgP5 1 6 J; 

Jh $ v n 5 * £ 7c ttjWE#*"Ca> 5 frZm^X&g * 

[0 0 7 9] 0 2 lfi. £3<D%tt0>ft?tt£J:SAa<P 
»Eft©*S 5^.5 3 Ofrbmfc • ftp 

mnzxt) u b& • * *n ^wagp 512 ice*** 

(xfj'/SSl) , B& • fpttHStn 5 1 5 ti, Kt> 
L7cB& • WflfRiBfc • ^n^fl«5 1 

S3 2) . Sik-*J»ro^attf#©4"^. A^Lfcili 

Ufy/S3 3) , -Sr*5fc©#*»**Ui. 
#»5 2 0tJ:9#firS:*i-5 Ur-^S3 6) . B 

Kb (^7 1 5'7S3 4) , B« • W^r^-fe^JPSiW 

©©ffiHrt-CfeS^^^^Sr^terf-S (^^•j/t'ss 
5) . ■fc-*w**#r**;*iMiRflm©«fflrt^ifc 

ntf, *»»*»5 2OlJ:j;01i«rSr*-f« (^f-^ 
S 3 6) 0 

[0 0 8 0] £Lk©<fc5(', **aKiJ:9, 

1) r^-fe^rt^i^cfc-fe^ay^^vaflWBSrft* 

2) o^tfceMa-efflv^sSJSS:, r^-fe^«g, 

-fe^rt^ (»#jZ.<^, UtT^if) tcjsc-cffi 

3 ) T ^ ir *«J PSif «© r *-t*¥3feMffl ^«PI«Ffl I- 
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5) fefifcfc, T^-fe^Sr^wiptcrFBTI- 

[0081] Lfc^ox, .toiftH^aeutc-fe'Sfay 

[0 08 2] 

[$8§H0>8i*] £t±tt?&Lfci:|3 9, *38WfcJ:;h,tf, 

lit, a#©«»i*45«a©r^"fe^sr*w-f5i 
[Bfiroffi¥&K93] 20 

[Ell] **W©«**»W1-5*:«>©BI-C*)*. 

[03] T?±7.u?(DM*m1rmx-hZ>o 
[04] a— iPtBM-5"ir*ay^-f«aflMio«tr* 

[05] =^t^-*{cH-T5-fe^yx^ i ff3lt*B(D 

[0 6] tf©T^-fe^^a©5>*©WSr*i-0 

30 

[0 7] r^-fe^JMI»flr«©«Sr^-H-C*S. 

[0 8] mm^-wctti-zTt-txmmffinvm*^ 

[09] *y Vy—?®&<DTi/-t*frb&bftZ>T9 
-fc* D ^<Df!l?r*-t-0T'fo-5o 
[01 0] *y b7—trm&e>T9±Xi)>t>ntbtl?>T* 
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* ^ir^.i3i/(D-fedf.3.y7 L ^ < i c Sffi#^JS:^i-0'Cfe 

[0n] t&i<Dmm<Di&mic£Z9m<Dffiiri<DU&$: 

[012] *10SlB»©«ttC*V^T**M«:im"J-* 

K^iTro«^Sr^i-0-C&5„ 
[013] **M©*2©l5*©»«|COV^Tro*rii« 
Sr^-f^n 5/^0-efc5 o 
[014] #fif«i31R^©«Sr^BI"e*>5. 
[015] ffftAaJaKX&fciSCfcaL— !ffc#i-5##© 
^Sr^1-0-e&5„ 

[016] &£&mm&cfcctz i §m%^tti-?>&%<D 

[017] »2OS0fi©»»tJ:««!aoj«no«KSr 
^-f-0T-&5o 

[018] *«w©iiS3'©iat©jgtticov^©«ia« 

[019] 018 fc*1-**»-p y VWUMftfflB* 

[020] hi 8te*-rfe*ay7^ea«««r&aE 

[02 1] *3©|lifio»l«K:i5fta©«n©«KSr 
^•t0-Cfc5o 
[«F*OR«] 

1 -fe^y-r^gmgie 

2 n&m 

i o T*-fc*gH^l8: 



1 1 

1 2 

1 3 

1 4 

2 0 

3 0 

3 1 

4 0 



I'm 



[03] 

user A4>7^tXDif 201 



[0 6] 



1 



3.— +f£;userA 
/ta^— K:paswd!#$123 
T^-fe* B B* : 1 998/8/25 1 8:30:34 

filel .txt: 1 998/8/25 1 8:32:34 
flle2.txt: 1 998/8/25 1 8:33:20 

execexe : 1 996/8/25 1 8:3230 




(11) 



^2 0 0 0- 1 4 8 2 7 6 



[Hi] 



[02] 



<r10 



1 4 



2_ 



— en 



2 0-) 



3 1 



40 



<100 -fe*a UfYim 



<1 1 O 



^201 



1 1 47 



1 v 5 «5 

1 1 5j 



1 1 6-> 



|trotni8g| 



12s 



7 ^t^E«» 
1 1 2j 



<203 



;2Q4 

1 7»**WBflHg] 



1 40 



[H4] 



1 



ZL— if £ : user A 

K:pa«wU#$123 

r*-feXBBfr:*DEI: 1996/4/25 10:3034. KTIal : 1 99B/B/24 10:32:34, B$H*F: 1ftOO :00- 19:00:00 
7$4rXL*r77-lMU: 

fllel.txt: $00: 1997/8/25 12:32:34. : 1 998/8/25 1 7:30:34. lift : 22. ttffflfc : 12.00:00 - 17:3fc34 
file2.txt: «JE]: 1997/8/30 10:3234. fflg: 1998/8/25 1 7:32:34. 8R:12. M8«: 1000:00 - 17:32:34 
exeo.exe:fcJE):1997/8/30 1032:34. flHa]: 1998/8/25 18:32*0. £ft:62. 5*SI*: 1000:00 - 19:30:34 

exeo.exe:tDl§]:1997/a/aO 10:32:34. tfrBl:T 998/8/25 16:32:20. &&:G2. B^KA?: 1000:00 - 19:30:34 
contexe: 10151:1997/8/31 10:32:34. «T@ : 1 998/8/25 18:2240. »R:105. Bfrfflfc: 1000:00 - 19:30:34 

compl , comp2, comp3 



(12) 



^§12000-148276 



[m 5 ] 



-fe "J T" •< Z03. 



□>tfa— *g:compB 
3©a.~+?:userA. userB, ... 

fliel.txt: 100: 1995/8/25 12:32:34. 1^0:1998/8/25 17:30:34. #£:222. B$M4ff : 12:0CH» - 17:30:34 
fiie2.txt: ft®: 1997/8/30 10:32:34. fltrB: 1998/8/23 17:32:34, &fiM22. BfrM* : 10:0000 - 17:32:34 
exeaexe:ftBI: 1998/5/31 10:32:34.1^19:1998/8/27 15:22:50. : 305. ^ffflW: 10:0000 - 15:30:34 

ex*c.exe:ft)@: 1995/8/30 10:32:34. KTQ: 1998/8/25 18:3220. «Jfi:642. StfHWf : 1 0:0000 - 19:30:34 
coiRaxe:493l3:1996/5/31 10:3254. ^0:1998/8/27 15:22:50. «ft:305. Bfflff: 1000:00 - 15:30:34 

r^-trX«3>tfiL— ^t: 

compl : 150 IhJ : 1 895/3/30 1 5:22:34. fir @ : 1 998/8/22 1 5:3240. : 542. ftfflfe : 1 5:0000 - 1 600:00 
eomp2:«Jls):1995/4/3 1532:23. «r® : 1998/8/25 18:32:20. ««:542. B*fW*&:15:00:00 - 19:00:34 j 

7*-kX£*ifea>t! a.— $i : 

compl: #30:1995/3/30 15:32:34.3*0:1998/8/20 15:3220. Mft: 542. RtyRfflf: 150000 - 170034 
comp2:&@: 1996/5/20 20:32:35. Wl® : 19&8/8/25 1 8:3220. MA: 344. B*H*:18:OO0O - 22:30:34 
serverl :406l: 1995/8/20 8:32*4. 15(3:1998/8/27 8:3220. «£:632. 8fr|H)?0:4:OO0O - 9:00:14 
' eerver2: 



[17] 



3- — if 45 : userA 

file1.txt: 8tt3iaT\ 8*013*9:0000 - 18:00:00&*r 
Ue2.txt:m&mT* B£IH^9:<»0O - 18:0000 
file3.txt: fttfimOOm - 0: 00: 00 El ^ 
3-7>K*frtS£: 

exec.oxo:^A3JblT. B*M*$90O:DO - 180000121* 
cmd.exo:$S&-1&T. KM* 000:00 - 000:00 tltt 



[18] 



J. — *f%\ : new 




T^-feX^WJUfifcE: 




file1.txt: «fl[0£lT. ESIWfc90O:OO - 


180000^ 


file2.txt:«flE0£lT. B|H*90O0O- 


180O0OJg4*r 


file3.txt: M »O0O:OO - 0:00:00 J2m 




=^>K3efT&5S: 




exec.exe: S&0I3LT. ftltt^rOaOO - 


-180O0O]Uft 


cmd.exe:«flM fcTF. ttH*fcO0O0O 


- O0O:QO£l9l 



im9] 



&«LT£fc=J>fcf:i— :mai|«orvor1 

;W056jfe: ueorA 
>-/K&i&fg*: senderX 
HfcLteaMfi— mailsorv2. mail8erv3 
^H^gfiBR: 1998/3/20 1422:36 



[Hi o] 



-fe^TJL 'J -T -f eSffttl 207. 



> — >H7>*&$te: userA, userB. ... 

>— ^KDj&ffiflS': senderX senderY, ssnderZ,.... 

«aU:3>ea-$€: rn.il.9rv2, mails* rv3 

;ua>a«Bfl&: 1998/3/201422:35 

ffiffl3fOh=J^:smtp.^ 
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NO 



[Hi 7] 
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J04 



fTi 



II 3] 
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r 400 -b^i «J ^-<fi«»B 



^201 



7* -feXfitt© 

112x 



1 1 A> 





"f- i £ 8B 
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1 1 3. 
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(1) 




(2) 




(3) 




(4) 




(5) 




(6) 




[016] 


(1) 




(2) 


SUt $ *t*:T* -t?XA<*> y * Lfc, 3.-^ : OOOOO 


(3) 




(4) 




(5) 




C6) 





[01 9] 




500 



[01 5] 



(1) 




(2) 




(3) 




(4) 




C5) 




(6) 





II 8] 



51 1-} 



f51 0 
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2L 



I 



S 15 > 



Ul2 



-1 



513 



520 



«# fi * ft 
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[02 0] 



630-] 



^5 0 0 
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